| #1 | AnyComment | 17 | 445 | 449 | 5k+ | | | Output is not escaped |
| #2 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 531 | 378 | 3m+ | | | Missing Translators Comment |
| #3 | Membership Plugin – Kadence Memberships | 19 | 5,085 | 3,003 | 9k+ | | | Text Domain Mismatch |
| #4 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 21 | 556 | 2,213 | 20k+ | | | Non-prefixed global variable |
| #5 | Filter Everything — WordPress & WooCommerce Filters | 21 | 634 | 943 | 50k+ | | | Non-prefixed global variable |
| #6 | BrikPanel: WooCommerce Dashboard, Abandoned Cart Recovery, Google Sheets Sync, Inventory Management & Bulk Editor | 23 | 5,257 | 1,985 | 1k+ | | | Text Domain Mismatch |
| #7 | CLUEVO LMS, E-Learning Platform | 23 | 1,843 | 1,176 | 400 | | | Text Domain Mismatch |
| #8 | Customer Reviews for WooCommerce | 23 | 2,217 | 2,443 | 80k+ | | | Output is not escaped |
| #9 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | 23 | 4,740 | 1,279 | 30k+ | | | Non Singular String Literal Domain |
| #10 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 23 | 4,156 | 1,553 | 100k+ | | | Output is not escaped |
| #11 | Slider by 10Web – Responsive Image Slider | 23 | 5,814 | 976 | 10k+ | | | Output is not escaped |
| #12 | Track, Analyze & Optimize by WP Tao | 23 | 895 | 756 | 600 | | | Output is not escaped |
| #13 | Event Tickets and Registration | 24 | 3,409 | 4,204 | 90k+ | | | Non-prefixed global variable |
| #14 | SecuPress with Simple SSL – Simple and Performant Security | 24 | 1,695 | 1,600 | 40k+ | | | Non-prefixed global variable |
| #15 | Affiliate Program Suite — SliceWP Affiliates | 24 | 1,266 | 2,084 | 10k+ | | | Output is not escaped |
| #16 | XT Ajax Add To Cart for WooCommerce | 24 | 985 | 1,665 | 1k+ | | | Non-prefixed global variable |
| #17 | XT Variation Swatches for WooCommerce | 24 | 1,033 | 1,809 | 500 | | | Non-prefixed global variable |
| #18 | Fluent Support – Helpdesk & Customer Support Ticket System | 25 | 89 | 277 | 10k+ | | | Direct Query |
| #19 | Infinite Uploads – Offload, Optimize & Organize Your Media Library | 25 | 586 | 738 | 800 | | | Direct Query |
| #20 | Participants Database | 25 | 941 | 893 | 7k+ | | | SQL query is not prepared |
| #21 | Simply Static – The Static Site Generator | 25 | 194 | 546 | 30k+ | | | Non-prefixed hook name |
| #22 | Smart Image Resize for WooCommerce | 25 | 582 | 404 | 7k+ | | | Text Domain Mismatch |
| #23 | Themify Event Post | 25 | 390 | 146 | 3k+ | | | Output is not escaped |
| #24 | XT Floating Cart for WooCommerce | 25 | 1,232 | 1,985 | 4k+ | | | Non-prefixed global variable |
| #25 | WP Crowdfunding | 25 | 190 | 1,600 | 2k+ | | | Non-prefixed global variable |
| #26 | XT Quick View for WooCommerce | 25 | 1,062 | 1,798 | 300 | | | Non-prefixed global variable |
| #27 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | 26 | 412 | 481 | 10k+ | | | Missing Translators Comment |
| #28 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 144 | 239 | 900 | | | Missing nonce verification |
| #29 | Order Tracking – WordPress Status Tracking Plugin | 28 | 619 | 773 | 3k+ | | | Unsafe printing function |
| #30 | Sessions | 32 | 205 | 103 | 900 | | | Output is not escaped |
| #31 | Big File Uploads – Increase Maximum File Upload Size | 32 | 65 | 116 | 100k+ | | | Input is not sanitized |
| #32 | CartBounty – Save and recover abandoned carts for WooCommerce | 33 | 370 | 399 | 10k+ | | | Output is not escaped |
| #33 | DHL eCommerce (Benelux) for WooCommerce | 34 | 218 | 330 | 2k+ | | | Nonce verification recommended |
| #34 | Event Calendar Newsletter | 34 | 96 | 167 | 600 | | | Non-prefixed hook name |
| #35 | HTML Import 2 | 34 | 273 | 26 | 5k+ | | | Unsafe printing function |
| #36 | Seriously Simple Stats | 34 | 99 | 126 | 5k+ | | | Output is not escaped |
| #37 | Donation Platform for WooCommerce: Fundraising & Donation Management | 34 | 331 | 448 | 7k+ | | | Non-prefixed global variable |
| #38 | SX User Name Security | 46 | 42 | 9 | 900 | | | Output is not escaped |
| #39 | WP User Groups | 48 | 42 | 50 | 600 | | | Missing Translators Comment |
| #40 | Bulk edit publish date | 62 | 11 | 16 | 2k+ | | | Nonce verification recommended |